codeforlife 2.6.4 → 2.6.6

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [2.6.6](https://github.com/ocadotechnology/codeforlife-package-javascript/compare/v2.6.5...v2.6.6) (2025-01-27)
+
+
+### Bug Fixes
+
+* csrf header for non-safe http methods ([#75](https://github.com/ocadotechnology/codeforlife-package-javascript/issues/75)) ([d0b2b78](https://github.com/ocadotechnology/codeforlife-package-javascript/commit/d0b2b7852fbdc9f84ade5ec4d46cc8a980e60f1e))
+
+## [2.6.5](https://github.com/ocadotechnology/codeforlife-package-javascript/compare/v2.6.4...v2.6.5) (2025-01-17)
+
+
+### Bug Fixes
+
+* unique values ([#74](https://github.com/ocadotechnology/codeforlife-package-javascript/issues/74)) ([1d183d2](https://github.com/ocadotechnology/codeforlife-package-javascript/commit/1d183d2806a7aa8ba98e78bf8a3fa9927ff37389))
+
 ## [2.6.4](https://github.com/ocadotechnology/codeforlife-package-javascript/compare/v2.6.3...v2.6.4) (2025-01-10)
 
 

package/package.json

@@ -2,7 +2,7 @@
   "name": "codeforlife",
   "description": "Common frontend code",
   "private": false,
-  "version": "2.6.4",
+  "version": "2.6.6",
   "type": "module",
   "scripts": {
     "dev": "vite",

package/src/api/createApi.ts

@@ -1,12 +1,14 @@
 import {
   createApi as _createApi,
   fetchBaseQuery,
+  type FetchArgs,
 } from "@reduxjs/toolkit/query/react"
 
 import { SERVICE_API_URL } from "../settings"
 import defaultTagTypes from "./tagTypes"
 import { buildLogoutEndpoint } from "./endpoints/session"
 import { getCsrfCookie } from "../utils/auth"
+import { isSafeHttpMethod } from "../utils/api"
 
 // TODO: decide if we want to keep any of this.
 // export function handleResponseError(error: FetchBaseQueryError): void {
@@ -36,8 +38,13 @@ export default function createApi<TagTypes extends string = never>({
   const fetch = fetchBaseQuery({
     baseUrl: `${SERVICE_API_URL}/`,
     credentials: "include",
-    prepareHeaders: (headers, { type }) => {
-      if (type === "mutation") {
+    prepareHeaders: (headers, endpoint) => {
+      const { type, arg } = endpoint as typeof endpoint & {
+        arg: string | FetchArgs
+      }
+      const method = typeof arg === "string" ? "GET" : arg.method || "GET"
+
+      if (type === "mutation" || !isSafeHttpMethod(method)) {
         let csrfToken = getCsrfCookie()
         if (csrfToken) headers.set("x-csrftoken", csrfToken)
       }

package/src/components/form/TextField.tsx

@@ -30,6 +30,8 @@ export type TextFieldProps = Omit<
   validateOptions?: ValidateOptions
   dirty?: boolean
   split?: string | RegExp
+  unique?: boolean
+  uniqueCaseInsensitive?: boolean
 }
 
 // https://formik.org/docs/examples/with-material-ui
@@ -40,6 +42,8 @@ const TextField: FC<TextFieldProps> = ({
   type = "text",
   required = false,
   dirty = false,
+  unique = false,
+  uniqueCaseInsensitive = false,
   split,
   validateOptions,
   ...otherTextFieldProps
@@ -49,7 +53,27 @@ const TextField: FC<TextFieldProps> = ({
   const dotPath = name.split(".")
 
   let _schema: Schema = schema
-  if (split) _schema = YupArray().of(_schema)
+  if (split) {
+    _schema = YupArray().of(_schema)
+    if (unique || uniqueCaseInsensitive) {
+      _schema = _schema.test({
+        message: "cannot have duplicates",
+        test: values => {
+          if (Array.isArray(values) && values.length >= 2) {
+            return (
+              new Set(
+                uniqueCaseInsensitive && typeof values[0] === "string"
+                  ? values.map(value => value.toLowerCase())
+                  : values,
+              ).size === values.length
+            )
+          }
+
+          return true
+        },
+      })
+    }
+  }
   if (required) {
     _schema = _schema.required()
     if (split) _schema = (_schema as ArraySchema<string[], any>).min(1)

package/src/utils/api.tsx

@@ -325,3 +325,8 @@ export function handleResultState<QueryArg, ResultType>(
   // Have yet to call the API.
   return loadingNode
 }
+
+export function isSafeHttpMethod(method: string) {
+  // https://datatracker.ietf.org/doc/html/rfc9110.html#section-9.2.1
+  return ["GET", "HEAD", "OPTIONS", "TRACE"].includes(method.toUpperCase())
+}